
%
% mxallowd 1.9 Manual
% (c) 2007-2009 Michael Stapelberg
%
% See http://michael.stapelberg.de/mxallowd
%
\documentclass[12pt, a4paper]{scrartcl}

\usepackage{ae}
\usepackage[latin1]{inputenc}

\usepackage{graphicx}
\usepackage{fancyhdr}
\usepackage{url}
\usepackage{listings}
\usepackage{palatino,avant}
\usepackage[pdftex,bookmarks=true,bookmarksnumbered=true,bookmarksopen=true,colorlinks=true,filecolor=black,
		linkcolor=red,urlcolor=blue,plainpages=false,pdfpagelabels,citecolor=black,
		pdftitle={mxallowd manual},pdfauthor={Michael Stapelberg}]{hyperref}

% New paragraph
\newcommand{\np}{\bigskip\noindent}
% Program name
\newcommand{\prog}[1]{\textit{#1}}
% Command name
\newcommand{\cmd}[1]{\textit{#1}}
% Left and right angle brackets
\newcommand{\la}{\textless}
\newcommand{\ra}{\textgreater}

% Figure names
\renewcommand{\figurename}{Abb.}
% No indention at new paragraphs
\setlength{\parindent}{0pt}
% listing-options
\lstset{frame=trbl,basicstyle=\ttfamily\small,captionpos=b}
% No tt-style
\urlstyle{rm}

\begin{document}

\title{mxallowd manual}
\author{Michael Stapelberg}
\date{Version 1.7, manual \today}

\maketitle

\tableofcontents

\clearpage

\section{Introduction}

\prog{mxallowd} is a daemon for Linux/netfilter (using libnetfilter\_queue) or BSD/pf (via pflog) which is a further improvement of the nolisting anti spam method. Basically, you configure two MX entries for your domain(s), but the first entry is invalid because there listens no mailserver. Some spammers will now try to only deliver their spam to the first mailserver and won't be successful. Your mailserver listens on the second entry and accepts e-mails. Real mailservers try -- unlike spammers -- all of the entries in correct order until they deliver their mail. Therefore, real mails get delivered and spam has to stay out.\np

The problem of nolisting is that some spammers (probably because of nolisting) directly use the second MX entry ("direct-to-second-mx"). This is where \prog{mxallowd} jumps in: You cannot connect to the second mailserver (packet is just dropped) if you did not try it on the first mailserver before.\np

This problem could basically be solved using iptables' module \prog{ipt\_recent}, if it wouldn't be for a little problem: Some providers (such as Google Mail) use the same hostname but different IP addresses in the same delivering cycle. That means that \prog{ipt\_recent} which works with IP addresses only does not accept emails from Google. \prog{mxallowd} therefore adds all the IP addresses of the hostname of the connecting machine to the whitelist (except if you specify $--$no-rdns-whitelist).\np

\subsection{License}

\prog{mxallowd} is free open source software under the GPLv2\footnote{\url{http://www.gnu.org/licenses/old-licenses/gpl-2.0.html}}.

\subsection{Development}

You can get the current state of development on \url{https://code.stapelberg.de/mxallowd/}.\np

Of course I'm happy about patches, feature requests or bugreports. You can find my email address and GPG key on \url{http://michael.stapelberg.de/Kontakt}.

\clearpage
\subsection{How it works}

The following figure shows how a connection may look like. "Spammer" means a not RFC conform mailserver and "mailserver" means an RFC conform one. The SMTP RFC requires a mailserver to try all MX entries in the given priority to deliver mail.\np

The spammer in this figure either directly connects to first (fake) mailserver or directly to the second one while the real mailserver tries both in order.

\begin{figure}[h!]
	\centering
	\includegraphics[width=0.75\textwidth]{scheme1.png}
	\caption{How it works}
\end{figure}

\clearpage
\section{Installation on Linux}

To forward new connections to \prog{mxallowd} you need to add the following rule in iptables:

\begin{lstlisting}
iptables -A INPUT -p tcp --dport 25 -m state --state NEW \
	 -j NFQUEUE --queue-num 23
\end{lstlisting}

If adding this rule doesn't work, you may not have loaded the \prog{nfnetlink\_queue} module (this should happen automatically):

\begin{lstlisting}
modprobe nfnetlink_queue
\end{lstlisting}

Of course you can modify this rule to filter only connections going to specific ip addresses or to whitelist connections of some ip addresses (using -j ACCEPT).\np

Since version 1.5, this also works with ip6tables and IPv6 connections.

\section{Installation on BSD}

Your \prog{/etc/pf.conf} could look like this:

\begin{lstlisting}
table <mx-white> persist

real_mailserver="192.168.1.4"
fake_mailserver="192.168.1.3"

real_mailserver6="2001:dead:beef::1"
fake_mailserver6="2001:dead:beef::2"

pass in quick log on fxp0 proto tcp from <mx-white> \
	     to $real_mailserver port smtp
pass in quick log on fxp0 inet6 proto tcp from <mx-white> \
	     to $real_mailserver6 port smtp
block in log on fxp0 proto tcp \
	      to { $fake_mailserver $real_mailserver } port smtp
block in log on fxp0 inet6 proto tcp \
	      to { $fake_mailserver6 $real_mailserver6 } port smtp
\end{lstlisting}

The important things are that the table \prog{mx-white} exist and that the pass- and the block-rules specify the log modifier. If you use another pflog-interface, you can tell mxallowd this via parameter.

\section{Help, I cannot send any mails anymore!}

That's right -- if you use the same mailserver to send mails, your mailclient usually tries only one connection (it's broken in this respect). I'd suggest you to use SMTPS (SSL) because its port (465) usually isn't filtered by \prog{mxallowd}. You could also configure your mailserver to listen on a completely different port which you use exclusively (spammer don't do portscans if they don't even use standard conforming mailers...). If you got a static IP address you can also whitelist it:\np

\begin{lstlisting}
iptables -I INPUT 1 -p tcp --dport 25 --s 192.168.2.3 -j ACCEPT
\end{lstlisting}

\end{document}
